Security audit

Macro Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This skill openly sets up autonomous pipeline work, but it gives recurring background agents broad write, command, commit, and external notification behavior without enough containment or review controls.

Review this skill carefully before installing. Use it only for repositories where unattended agent edits and commits are acceptable, avoid confidential projects unless Discord notifications are removed or tightly controlled, replace git add . with explicit file staging, and require approval or pinning before cron jobs execute mutable pipeline steps.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

Location: SKILL.md:74
Finding: Persistent Autonomous Execution Through Scheduled Heartbeats
Content: View full analysis
Pipeline" --agent --every 30m --message "Heartbeat: lee HEARTBEAT.md y ejecuta siguiente step" ``` ``` ```markdown 2. **HEARTBEAT.md siempre en workspace** — nunca en repo 3. **HEARTBEAT es immutable** — locked con `chflags uchg` 4. **Crons vía CLI** — `openclaw cron add`, nunca editar openclaw.json ``` ### Technical Analysis The Skill directs the agent to create a recurring OpenClaw cron job that executes every 30 minutes. The scheduled message instructs the agent to read `HEARTBEAT.md` and execute the next pipeline step. It also requires that the controlling heartbeat file be made immutable with `chflags uchg`. This creates cross-session persistence: pipeline activity can continue after the original Skill invocation and in the absence of an active user session. Making the instructions immutable also hinders ordinary modification or remediation. The scheduled process operates with the permissions and tool access of the configured OpenClaw agent. No expiration, maximum execution count, explicit per-run approval, or cleanup procedure is specified. ### Attack Path 1. A user or agent follows the Skill and creates `HEARTBEAT.md`. 2. The file is locked with `chflags uchg`, preventing ordinary modification. 3. The prescribed `openclaw cron add` command installs a recurring 30-minute job. 4. Each invocation causes the configured agent to read the heartbeat instructions and process a pipeline step. 5. The activity continues across sessions until the cron entry is explicitly removed and the file lock is cleared. 6. If the mutable pipeline is later modified maliciously, the persistent scheduler repeatedly provides an execution opportunity. ### Impact Assessment ...[truncated 455 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:48
Finding: Mutable Pipeline Content Controls Autonomous Agent Execution
Content: View full analysis
/`) | State + progress | ✅ Yes (subagents update directly) | | `HEARTBEAT.md` | **Agent workspace** (`~/.openclaw/workspace-/`) | Instructions (read-only) | ❌ No (locked with `chflags uchg`) | ``` ```markdown ### Step fields: - `engine:` — `claude-code` | `human` | `deploy` - `depends_on:` — list of step numbers that must be ✅ first - `parallel:` — list of steps that can run simultaneously - `verify:` — shell command to validate completion - `artifacts:` — outputs passed to dependent steps - `files:` — key files modified --- ## HEARTBEAT.md Format ```markdown # HEARTBEAT — > ⚠️ NUNCA modifiques este archivo (HEARTBEAT.md). Es read-only. ## Pipeline activo: ~/Documents/proyectos//PIPELINE.md ## Protocolo cada heartbeat: 1. Lee el pipeline activo (ruta absoluta arriba) 2. Si hay step [PENDING] sin dependencias bloqueadas → ejecútalo 3. Marca [RUNNING YYYY-MM-DDTHH:MM] con timestamp actual 4. Ejecuta: sessions_spawn(task=..., thread=true) 5. Un step por heartbeat máximo ``` ``` ### Technical Analysis The architecture treats repository-controlled `PIPELINE.md` content as executable agent instructions while explicitly allowing subagents to modify that file. Pipeline fields include free-form task descriptions and shell-based `verify` commands. The heartbeat then directs the agent to read pending steps, execute them, and pass their tasks into `sessions_spawn`. Repository content therefore crosses an instruction and code-execution trust boundary without validation. A contributor, compromised subagent, malicious commit, or other process with repository write access can modify a pending step so that a future heartbeat interprets attacker-controlled text as an ...[truncated 1424 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:124
Finding: Blanket Git Staging Can Commit Sensitive or Unrelated Files
Content: View full analysis
/step-: " ``` ``` ### Technical Analysis The prescribed command uses `git add .`, which stages all unignored changes under the current repository path. It does not limit staging to the files declared by the pipeline step or the artifacts intentionally generated by that step. A repository may contain unrelated user work, generated output, environment files, credentials, debugging logs, or attacker-planted files. If these files are not excluded by `.gitignore`, the blanket staging command adds them to the commit. Once committed, sensitive content remains in Git history even if it is removed in a later commit. The command also chains staging and committing with `&&`, leaving no required review step between collection of changes and creation of the commit. ### Attack Path 1. A sensitive, unrelated, or malicious file is created within the repository and is not covered by `.gitignore`. 2. A pipeline step completes. 3. The agent runs `git add .`. 4. Git stages the intended step output together with every other unignored change in scope. 5. The agent immediately creates the pipeline commit without inspecting the staged diff. 6. If the repository is later pushed, the unintentionally committed content is distributed to the remote and its users. ### Impact Assessment This issue can disclose credentials, configuration, source code, logs, or other project data through local or remote Git history. It can also introduce unrelated or attacker-controlled modifications into trusted pipeline commits. The direct scope is the current repository, while subsequent pushes can expand the exposure to all users and systems with access to the remote repository. ...[truncated 3 chars]
Remediation: View remediation

other

Warning

Location: SKILL.md:85
Finding: Unreviewed Task Summaries Are Sent to an External Discord Channel
Content: View full analysis
: cambia Step X de [RUNNING] a [✅ COMPLETED] con output y artifacts 2. Si fallas, marca [FAILED] con el error 3. Notifica a Discord (action=send, channel=discord, target="channel:") con resumen ``` ``` ### Technical Analysis The mandatory subagent template instructs each task to send a summary to a Discord channel. No content classification, redaction, destination validation, preview, consent, or maximum-detail policy is defined. Task summaries and failure reports can contain project names, source paths, command output, error messages, artifact details, internal identifiers, or fragments of processed data. Because Discord is an external service, this creates a data boundary crossing. The risk increases if the channel identifier is incorrect, attacker-controlled, broadly accessible, or associated with a workspace whose retention policy is unsuitable for the project. ### Attack Path 1. A subagent processes project files or executes a command that produces sensitive output. 2. The task succeeds or fails and generates a summary or error description. 3. The template directs the subagent to invoke the Discord `send` action. 4. Sensitive details included in the generated message are transmitted to the configured channel without review. 5. Channel members, bots, integrations, or retained service logs gain access to the disclosed information. ### Impact Assessment The issue can disclose information available in task results and errors to an external Discord destination. The potential scope includes project metadata, internal paths, source details, artifacts, logs, and secrets accidentally included in command output. It does not independently grant additi ...[truncated 156 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill normalizes direct autonomous modification of repository files by subagents without any user-facing warning, approval checkpoint, or safety boundary. In a cron-driven autonomous workflow, this can lead to silent state changes, accidental corruption, or unauthorized edits in tracked project files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs operators to configure recurring cron-based autonomous execution without prominently warning that the agent will continue acting in the background. Persistent unattended execution materially increases risk by enabling repeated file modifications, task execution, and possible misuse long after the initiating user interaction has ended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs agents to send task summaries to Discord without warning that repository or operational information may be transmitted to an external service. This creates a clear privacy and data leakage risk, especially when failure messages, artifacts, or summaries may contain sensitive project details.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs subagents to send Discord notifications even though the declared purpose is pipeline planning and execution management. This introduces unnecessary external communication and potential data egress of task status, errors, artifacts, or repository context to a third-party service without clear justification or user consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file mixes English headings with mandatory template content and operational instructions in Spanish such as Proyecto, Objetivo, NUNCA modifiques, and heartbeat directives. There is no indication that language choice is optional or user-configurable, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The HEARTBEAT format says 'Un step por heartbeat máximo,' indicating only one step should be executed each cycle. Later, the parallel execution section states the heartbeat may launch multiple parallel steps in one cycle, which is a direct contradiction in the documented operational intent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The text says each completed step must create a 'commit taggeado' and the heading is 'Git Tagging,' implying creation of a git tag. However, the sample command only performs 'git add' and 'git commit' and does not create any tag, so the operational instruction contradicts the documented claim.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.